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Description 

The present invention relates to cable television ap- 
paratus, and more particularly to a converter with re- 
motely modifiable functionality provided by downloada- 
ble firmware. 

Cable television converters are currently available 
that allow a cable system operator to remotely control 
subscriber service authorizations from a central "head- 
end" site. These units, which are commonly referred to 
as "addressable converters", allow the cable system op- 
erator to control access to various premium services by 
sending a control signal from the headend to individual 
converters located at subscribers' homes. The authori- 
zation signals are carried on the cable television system, 
and enable individual subscribers to view programs that 
they pay an additional fee for. In operation, the control 
signals typically enable the converter to descramble the 
premium channels for viewing by the subscriber. 

Other addressable systems currently available al- 
low a limited set of operational parameters to be down- 
loaded to a converter from the headend. Such opera- 
tional parameters include, for example, information that 
maps displayed channels to tuned channels, time-out 
periods, barker channel(s), the converter output chan- 
nel, the terminal configuration, and enable/disable func- 
tions for subscriber features such as remote hand-held 
control, parental control, favorite channel recall, volume 
control, and the like. The current state of the art is to 
download configuration information for a set of features 
that have been predetermined at the time of manufac- 
ture or installation of the cable television converter. An 
example of such a converter is the Model DPV7200 ad- 
dressable converter manufactured by the Jerrold Divi- 
sion of General Instrument Corporation, Hatboro, Penn- 
sylvania, U.S.A. 

Other systems with downloadable data capabilities 
are also known. U.S. Patent 4,054,911 to Fletcher, et al. 
relates to an information retrieval system capable of 
capturing packets or rows of video displayable data and/ 
or control program instructions from data continuously 
transmitted in a common predetermined format. In the 
system disclosed in the patent, a user decides what in- 
formation is to be retrieved, and takes action to cause 
a terminal to retrieve that information. Although a user 
can vary the function of the terminal by capturing differ- 
ent transmitted data, it is the user that determines what 
video displayable information is to be received, and how 
the terminal which receives this information is to process 
it. There is no disclosure or provision of means to enable 
a system operator to establish the functional operation 
of individual terminals on a multi-terminal network. 

In commonly owned U.S. Patent 4,71 2,239 to Frez- 
za, et al. entitled "Security Arrangement for Download- 
able Cable Television Converters", incorporated herein 
by reference, a downloadable converter is disclosed 
that prevents a false booter image from being download- 
ed. A false image could subject the system to various 



integrity problems, such as enabling an unauthorized 
userto view premium programs. In the patented system, 
a booter image is received on one channel and a check- 
sum is computed there from. A valid checksum, extract- 
s ed from tag data transmitted on a separate channel and 
associated with a scrambled program signal, is com- 
pared with the computed checksum. If the checksums 
do not match, a descrambler in the converter is preclud- 
ed from descrambling the program signal. The system 
disclosed in this patent downloads all of the operating 
software to a cable television converter over a dedicated 
"booter channel", to which the converter is force tuned 
when first turned on. After the download is complete, the 
converter's data receiver is returned to the regular data 
channel, where it remains until the converter is turned 
off. 

US-A-4,623 920 discloses a cable television con- 
verter comprising: 

means for receiving functional operating software 
(firmware) downloaded from a remote cable televi- 
sion headend; 

means coupled to said receiving means for storing 
said downloaded functional operating software 
(firmware); 

means for verifying said downloaded functional op- 
erating software (firmware) and 
processor means coupled to said storing means for 
accessing and executing said downloaded func- 
tional operating software (firmware). 

EP-A-0 187 973 discloses a cable television con- 
verter comprising processor means and a stored algo- 
rithm for descrambling a scrambled television channel. 
For enabling the descrambling the processor means re- 
ceive an address word and in addition a coded starting 
word. The starting word is comprising the starting ad- 
dress for decoding. 

EP-A- 0 132 401 discloses a cable television con- 
verter which is supplied with at least two keys from the 
transmitting side for reproducing a transmitted informa- 
tion by using the two keys. 

US-A- 4,710,955 discloses a cable television con- 
verter for receiving a scrambled television signal. This 
signal is selectively descrambled in response to sub- 
scriber action. The signal received from the headend is 
monitored by the subscriber terminal for a call-in com- 
mand which instructs the subscriber terminal to forward 
the record of billable programs to the headend over a 
telephone communication path. Transaction credits can 
be downloaded from the headend to the subscriber ter- 
minal. 

In Funkschau, No. 5, 24th February 1989, pages 
59-62; C. Schepers: "Der Schlussel zum Scrambling 
Problem?" a converter is disclosed which receives key- 
ing information as well as addressable data for opera- 
tion of the descrambler. 

GB-A-2 1 1 8 750 discloses a converter receiving op- 
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tion address data which are stored into the subscriber 
stations over the network from a headend. The data can 
be control signals for controlling the descrambling of 
premium TV-signals, software for operating a micro- 
computer, data to facilitate selection of particular TV 
channels depending on service paid for, etc. 

The problem of the present invention is to provide 
a method and a system for remotely modifying the func- 
tionality of a cable television converter or other terminal 
which is more acceptable for a user 

According to the present invention this problem is 
solved by a remotely controllable cable television con- 
verter which is able to operate in a baseline mode al- 
lowing the reception of a television program and which, 
upon receipt of functional operating software (firmware) 
downloaded from a remote cable television headend, 
can be provided with higher levels of converter functions 
resulting in an increased converter functionality in addi- 
tion to said baseline mode, said converter comprising: 

means for receiving said functional operating soft- 
ware (firmware) downloaded from said remote ca- 
ble television headend; 

means coupled to said receiving means for storing 
said downloaded functional operating software 
(firmware); 

means for verifying said downloaded functional op- 
erating software (firmware); 
processor means coupled to said storing means for 
accessing and executing said downloaded func- 
tional operating software (firmware); 
nonvolatile memory means coupled to said proces- 
sor means for storing default operation software, 
said default operation software providing said base- 
line mode operation to said converter; and 
means responsive to said verifying means for caus- 
ing said processor means to execute said default 
operation software instead of said downloaded 
functional operating software (firmware) in the 
event the downloaded software is invalid or con- 
tains errors. 

Further advantageous embodiments are subject 
matter of claims 2 to 20. 

Due to the fact that according to the present inven- 
tion the downloaded functional operating software is 
subject to some kind of verification proceedings by said 
means for verifying, it can occur that no functional op- 
erating software is available at the converter. If then the 
system is not able to reproduce any television program, 
but only for example snow on the screen or blanking as 
known from converters according to prior art, the cable 
television converter will not be acceptable for a user. 

According to the present invention, acceptability of 
the system is achieved by providing the converter with 
baseline operational characteristics so that the user is 
always enabled to still receive at least one television 
program even though the downloaded operational soft- 



ware is not received. 

In addition, the inventive concept enables the oper- 
ator to provide a more intensive verification of the down- 
loaded functional operation software, a proceeding 

s which is necessary as a security feature to guard against 
infiltration of the converter by a "software pirate". 

It is an advantage to have a method and system for 
downloading firmware to a remote terminal, such as a 
cable television converter, which allows modification of 

'0 virtually any or all firmware functions of the terminal by 
the system operator. It is further advantageous for such 
a method and system to enable the system operator to 
replace or modify options that were predetermined at 
the time of manufacture or installation of the terminal. 

'5 By effecting terminal modifications automatically from a 
headend location, such a method and system eliminates 
the need for a technician to travel toa subscriber's home 
to modify or physically replace a subscriber's terminal 
to effect such functional modifications. 

20 In accordance with a preferred embodiment of the 
present invention, a cable television converter with re- 
motely modifiable functionality is provided. The convert- 
er includes means for receiving functional operating 
software (firmware) downloaded over a cable television 

25 network, and means coupled to the receiving means for 
storing the functional operating software (firmware). 
Means are provided for verifying the integrity of the func- 
tional operating software (firmware), and processor 
means coupled to the storing means accesses and ex- 

30 ecutes the functional operating software (firmware) to 
provide one or more converter functions dictated by the 
functional operating software (firmware). Nonvolatile 
memory means are coupled to the processor means for 
storing default operation software for the converter 

35 Means responsive to the verifying means cause the 
processor means to execute the default operation soft- 
ware, instead of the downloaded functional operat- 
ing'software (firmware), in the event the integrity of the 
functional operating software (firmware) is not verified. 

40 Data receiving means are provided in accordance 
with a further embodiment for obtaining instructions 
downloaded over a cable television network. Download- 
ed functional operating software (firmware) is received 
and stored by the converter only in response to specific 

45 instructions received by the data receiving means. 

The functional operating software (firmware) re- 
ceiving means and data receiving means can comprise 
a frequency agile data receiver, together with means for 
selectively tuning the receiver, to receive instructions on 

50 a first channel and downloaded functional operating 
software (firmware) on a second channel. 

In a further embodiment timer means return the re- 
ceiver to the first channel if the receiver has been tuned 
to the second channel for predetermined time period. 

55 The predetermined time period may be specified in in- 
structions received on said first channel, and the length 
of the time period may be dependent on an amount of 
functional operating software (firmware) to be received. 
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In this manner, a converter will not become stuck on the 
second channel by error, and be rendered unable to re- 
ceive further instructions on the first channel. 

The downloaded functional operating software 
(firmware) received and stored by the converter can im- s 
plement a functional layout on a keyboard associated 
with the converter. Functional operating software 
(firmware) can also implement a feedback function, 
such as an LED (light-emitting-diode) display or on- 
screen display to assist a user in operating the convert- 
er. A control function for a video recorder coupled to the 
converter can also be implemented by the functional op- 
erating software (firmware). Similarly, the functional op- 
erating software (firmware) can implement a communi- 
cation protocol for the converter, a descrambling tech- 
nique for the converter, an on-screen display to be pro- 
vided by the converter to a television coupled thereto, 
and/or a user interface to services provided over the ca- 
ble television network. 

In a further preferred embodiment of the present in- 
vention, functional operating software (firmware) is 
transmitted in an encrypted form, and the instructions 
contain a key for decrypting the functional operating 
software (firmware). The functional operating software 
(firmware) may also be received by the converter in a 
plurality of segments, with the instructions identifying 
the number of segments to be received for a complete 
functional operating software (firmware) download. 
Means can be provided for determining if all of the seg- 
ments have been validly received, and for receiving re- 
placement segments if one or more segments of the 
functional operating software (firmware) have not been 
validly received. Receipt of firmware can be prevented 
if the number of segments identified by the instructions 
is greater than a predetermined limit. 

According to a further preferred embodiment a 
method for providing the cable television converter with 
functions dictated by downloaded functional operating 
software (firmware) is also provided. Converter control 
data is received from a remote location via a cable tel- 
evision network. A designated functional operating soft- 
ware (firmware) package is captured from a set of func- 
tional operating software (firmware) packages carried 
on the cable television network, in response to instruc- 
tions contained in the converter control data. The des- 
ignated functional operating software (firmware) pack- 
age is stored in a memory provided in the converter, and 
is executed to provide at least one converter function 
dictated thereby. 

The functional operating software (firmware) pack- 
ages may be carried on the cable television network in 
encrypted form, and decrypted using a key contained in 
the converter control data. In one embodiment, the con- 
verter control data is received on a first data channel 
and the functional operating software (firmware) pack- 
ages are captured from a second data channel on the 
cable television network. The first channel is monitored 
to receive converter control data, and the second chan- 



nel is tuned to capture functional operating software 
(firmware) upon receipt of appropriate instructions on 
the first channel. Reception is returned to the first chan- 
nel after the functional operating software (firmware) is 
captured. If the functional operating software (firmware) 
has not been captured within a predetermined time pe- 
riod, reception switches back to the first channel from 
the second channel. 

In accordance with another embodiment of the 
present invention, a remotely modifiable converter (user 
terminal) is provided which comprises means for receiv- 
ing a plurality of cyclically transmitted functional operat- 
ing software (firmware) segments, the segments togeth- 
er comprising a functional operating software (firmware) 
package. Means coupled to the receiving means verify 
each segment upon receipt thereof, and means are pro- 
vided for storing each verified segment. A determination 
is made as to whether a complete functional operating 
software (firmware) package has been stored in the 
storing means at the completion of a functional operat- 
ing software (firmware) transmission cycle. If not, then 
reception, verification, and storage of transmitted func- 
tional operating software (firmware) segments contin- 
ues during a subsequent functional operating software 
(firmware) transmission cycle. Reception of the func- 
tional operating software (firmware) segments is termi- 
nated upon a finding that a complete functional operat- 
ing software (firmware) package has been stored. 
Means can further be provided for precluding the exe- 
cution of functional operating software (firmware) seg- 
ments until a complete functional operating software 
(firmware) package has been stored. 

The verifying means can operate by testing a 
checksum for each functional operating software 
(firmware) segment as it is received. The converter (ter- 
minal) may further comprise means for maintaining a 
record of the proper checksum for each segment, and 
means for periodically retesting the checksums after a 
complete functional operating software (firmware) pack- 
age has been stored. Default operation software may 
be stored for the converter (terminal), and executed if 
the checksums are not verified upon retesting. The com- 
plete functional operating software (firmware) package 
may also be verified after it has been stored, and the 
default operation software executed if the complete 
functional operating software (firmware) package is not 
valid. The default operation software may also be exe- 
cuted if reception of functional operating software 
(firmware) segments is not completed during a prede- 
termined time period. 

A complete functional operating software 
(firmware) package may include a plurality of modules. 
Execution of fewer than all of the modules may be pre- 
cluded as an additional security feature. 

Further features and advantages of the present in- 
vention are subject matter of the following description of 
embodiments and the drawings. 
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Figure 1 is a block diagram of a functionally modifi- 
able cable television converter system in accord- 
ance with the present invention; 
Figure 2 is a block diagram of the pertinent ele- 
ments of a converter used in connection with the 
system of the present invention; 
Figure 3 is a flowchart illustrating steps taken by the 
headend when it receives a new firmware package 
or an assignment to download firmware to a con- 
verter; 

Figure 4 is a flowchart illustrating the continuous 
transmission of firmware over a secondary data 
channel; 

Figure 5 is a flowchart illustrating the steps taken 
by a converter in receiving downloaded firmware; 
and 

Figure 6 is a flowchart illustrating the periodic rever- 
ification of downloaded software by a converter. 

Turning to Figure 1 , a cable television system is de- 
picted having headend components, generally desig- 
nated 10 and subscriber components, generally desig- 
nated 12. The headend communicates with the sub- 
scriber via a distribution cable 36. A firmware develop- 
ment system 16 is used to create new functional 
firmware packages for subscriber terminals, such as 
converter 40. Firmware development system 1 6 may be 
physically located at the headend, but is more typically 
located at the facilities of a vendor which develops new 
firmware programs for sale to a cable system operator. 
New firmware packages may be transferred to an ad- 
dressable controller 1 4 located at the headend by mag- 
netic tape 20 which is read by addressable controller 14, 
or by communication between the firmware develop- 
ment system 1 6 and addressable controller 14 via direct 
connection or modems 18 operating over conventional 
telephone lines. Those skilled in the art will recognize 
that other means may also be available for transferring 
firmware from firmware development system 16 to ad- 
dressable controller 1 4. 

Once firmware is resident in addressable controller 
14, it is transmitted repeatedly over a data channel. The 
data channel may be either the primary addressable da- 
ta channel provided in a conventional cable television 
network having addressable converters, or a separate 
secondary data channel. In either event, the data chan- 
nel (s) can transmit the data on an FSK modulated FM 
carrier or by any other suitable transmission scheme 
well known in the art. 

The use of a secondary channel for downloading 
firmware to converters is illustrated in Figure 1 . Control 
signals, including data such as converter addresses, 
program authorization codes, and the like is communi- 
cated from addressable controller 14 to a converter 40 
via control data modulator 26. The output of control data 
modulator 26 is coupled to distribution cable 36 via a tap 
34, and data is received therefrom by converter 40 via 
tap 38. The control data modulator transmits the data 



signals on a primary channel, and in accordance with 
the present invention, the data includes instructions to 
converter 40 which cause the converter to receive spec- 
ified firmware downloaded from addressable controller 

5 14. 

In the two channel embodiment illustrated in Figure 

1, the firmware is transmitted on a secondary channel 
by firmware modulator 24, coupled to the cable network 
at tap 30. Upon receipt of instructions on the primary 
channel, converter 40 switches to the secondary chan- 
nel for receipt of designated firmware. An additional data 
path 28 may optionally be provided via tap 32 for receipt 
of data from converter 40 by addressable controller 14. 
Such data might include, for example, a verification that 
converter 40 has successfully received a firmware pack- 
age it has been instructed to receive. The provision of 
a return path 28, which provides a "two-way" cable com- 
munication system, is well known in the art. 

Billing system 22 is provided at the headend for 
maintaining accounting information relating to charges 
incurred by subscribers on the cable system. In accord- 
ance with the present invention, different firmware pack- 
ages downloaded by headend 10 to converter 40 may 
provide different converter functions, with higher levels 
of service providing increased converter functionality. 
Billing system 22 keeps track of the level or service for 
each subscriber, and assigns particular firmware pack- 
ages to subscriber converters on the basis of converter 
functionality to be provided to each subscriber. 

At the subscriber location 12, a subscriber may 
have one or more video appliances 42, 44 coupled to 
the output of converter 40. For example, video appliance 
42 might be a television set, and video appliance 44 
might be a video recorder {'VCR'). In accordance with 
the present invention, firmware downloaded to convert- 
er 40 can provide functions relating to a VCR. An exam- 
ple of such a function is time controlled programming. 
This function enables the converter to be programmed 
to make channel changes at various times so that the 
VCR can record different television programs on differ- 
ent channels automatically and while unattended. Such 
a function can also enable "impulse pay-per-view" or- 
ders to be programmed into the converter by a subscrib- 
er, so that special premium programs can be ordered, 
when the subscriber is not home, and recorded on the 
subscriber's VCR for later viewing. 

Figure 2 is a block diagram illustrating the pertinent 
components in one embodiment of a converter 40 in ac- 
cordance with the present invention. In the embodiment 
illustrated, the converter receives addressable data on 
one data channel and downloaded firmware on another 
data channel. It is noted that in another embodiment of 
the invention, both the addressable data and the 
firmware can be received over a single data channel. 
Or, the firmware may be carried on some other media, 
such as the public telephone network. 

In the two channel embodiment illustrated in Figure 

2, a microprocessor 50 receives data from cable 36 via 
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a frequency tunable receiver 52. A transmitter 61 and 
return path 62 can be provided from microprocessor 50 
back to addressable controller 14 in the event the con- 
verter is used with a two-way cable television system. 
Like receiver 52, transmitter 61 can be frequency tuna- 
ble to enable a choice of return transmission frequen- 
cies. 

A tuner 54, under the control of microprocessor 50, 
tunes frequency tunable receiver 52 to either a primary 
channel for receipt of addressable data (e.g., instruc- 
tions to capture a particular firmware package) or to a 
secondary channel for the receipt of firmware. Although 
a single secondary channel is described herein for pur- 
poses of illustration, it will be appreciated that any 
number of such secondary channels can be provided, 
depending on system requirements. Typically, frequen- 
cy tunable receiver will be tuned to the primary channel, 
and will only switch to the secondary channel upon spe- 
cific instructions contained in data received on the first 
channel. In the alternate embodiment where both ad- 
dressable data and firmware are received on a single 
data channel, frequency tunable receiver 52 and tuner 
54 can be replaced with a fixed frequency data receiver. 

The provision of a dedicated secondary data chan- 
nel as illustrated in Figure 2 is advantageous. By keep- 
ing firmware data off of the primary channel, the data 
throughput load on this channel is reduced. 

In the two channel embodiment, firmware data is 
broadcast cyclically on the second channel, by address- 
able controller 1 4 at the headend. In a preferred embod- 
iment, a plurality of different firmware packages are 
broadcast on the secondary channel, each package 
providing different converter functions or combinations 
of functions. Upon receipt of instructions on the primary 
channel, microprocessor 50 will cause tuner 54 to switch 
receiver 52 to the secondary channel for receipt of a 
designated firmware package. 

Various memory devices are coupled to microproc- 
essor 50, including read only memory ("ROM") 56, op- 
erating random access memory CRAM") 58, and non- 
volatile firmware RAM 60. ROM 56 contains a program 
that allows converter 40 to retrieve and execute a down- 
loaded firmware package. Upon receiving the proper 
command from the addressable controller, the converter 
aborts any down loaded package currently being execut- 
ed, accesses the appropriate data channel for receipt of 
a designated firmware package to be downloaded, and 
receives and loads the firmware into nonvolatile 
firmware RAM 60. 

ROM 56 also contains default operation software, 
which is used to restore the converter to a nominal or 
"baseline - operation if a bad firmware download occurs. 
As explained below, if an error is detected in the receipt 
of downloaded firmware, or if the firmware is found to 
be invalid, the converter is forced to execute only the 
default operation software stored in ROM 56. 

A timer 64 is associated with microprocessor 50 to 
provide a time-out feature that prevents the converter 



from getting stuck on the secondary channel, in the 
event there is a problem receiving specified firmware. 

When billing system 22 assigns a new firmware 
package to a particular converter 40, addressable con- 

5 troller 14 is commanded to transmit instructions to the 
converter. The instructions are received by microproc- 
essor 50, and include an identifier specifying which 
firmware package to receive, where to find the firmware 
package (i.e., on the primary or a specified secondary 

10 channel), a predetermined time limit defining how long 
the converter should attempt to receive the firmware be- 
fore aborting, a key to use in decrypting the data in the 
event it is encrypted, and the maximum segment 
number to be loaded (indicating how many segments 

is are included in the firmware package to be received). 
While the firmware is being received, timer 64 counts 
down the time-out period specified in the download com- 
mand. If the timer expires, microprocessor 50 aborts the 
download, and returns to the original data channel. The 

20 time-out period specified in the download command can 
be varied depending on the amount of firmware to be 
downloaded. 

Timer 64 is also used in connection with a self- 
check that is periodically performed by the converter to 

25 ensure that the firmware has not changed since the last 
authorized download. This self-check is a security fea- 
ture to guard against infiltration of the converter by a 
"software pirate" who attempts to download unauthor- 
ized software to the converter, in an effort to steal serv- 

30 ices from the cable system. 

In accordance with the self-check procedure, timer 
64 retests the checksum for each of the firmware seg- 
ments at regular intervals after the firmware has been 
downloaded. In the event a checksum is found to be 

35 invalid, microprocessor 50 restores the converter to 
baseline operation by executing the default operation 
software contained in ROM 56. 

Converter 40 contains various other components 
with functions that can be modified by downloaded 

40 firmware. For example, a light-emitting-diode ("LED") 
display or other display 66 may be provided on the con- 
verter to give a user feedback concerning converter op- 
erations. Pressing a button on the converter, or its re- 
mote control unit, can cause an LED to light, verifying 

45 that the button has been pressed or that a function to 
be activated by the button has occurred. Such a feed- 
back function is useful to assist a user in operating the 
converter. 

The converter also includes a keyboard 66, the 
50 functional layout of which can be defined and/or modi- 
fied by firmware downloaded to the converter. Keyboard 
68 may be physically on the converter box, on a remote 
hand-held unit for the converter, or a separate keyboard 
can be provided in both places. 
55 Converter 40 also includes a descrambler 70 for de- 
scrambling premium programs received via the cable 
television network. Various descrambling techniques 
are well known in the art, and different techniques can 



6 



11 



EP 0 399 200 B1 



12 



be implemented by downloading different firmware to 
the converter. 

Another feature that can be provided by converter 
40 is the display of information on a user's television set. 
On-screen display driver 72 is provided for this purpose, s 
An example of such a display is the channel number 
tuned to, or the current time. In addition, on-screen dis- 
plays can be used to distribute messages from the cable 
system operator, e.g., "your account is past due; please 
send us a check*. An electronic mail, or 'E-mail - feature 
can also be provided, enabling a subscriber to send and 
receive text messages on his television (or other dis- 
play) via the cable system. The implementation and/or 
modification of on-screen displays can be provided by 
firmware downloaded to the converter. 

In order to provide a measure of protection against 
illegal use of the firmware download feature, the 
firmware is downloaded to the converter in an encrypted 
form. The data is decrypted at the converter by a de- 
cryption module 74. A decryption key is transmitted to 
the converter from the headend as part of the address- 
able data instructions that command the converLer to 
receive a particular firmware package. Encryption and 
decryption schemes are well known in the art. Examples 
of such schemes are provided in commonly owned U. 
S. Patent Nos. 4,638,356 of William A. Frezza, entitled 
■Apparatus and Method for Restricting Access to a 
Communication Network" , and 4,710,955 of Marc W. 
Kauffman, entitled "Cable Television System with Two- 
Way Telephone Communication Path". Both of these 
patents are incorporated herein by reference. 

A viewership monitor 76 can be provided in accord- 
ance with the present invention to enable a cable system 
operator to determine what programs and services a 
subscriber has received using each converter, and/or to 
retrieve a list of the functions which have been used on 
each converter. Viewership monitor 76 will monitor the 
operation of the converter, and store pertinent data re- 
lating thereto. By addressing an appropriate command 
to the converter, the cable system operator will be able 
to upload the data to the headend for analysis. 

Other functions that can be implemented by 
firmware downloaded to the converter include commu- 
nication protocols for the converter, and user interfaces 
to services provided over the cable television network. 
For example, a user may be provided with the capability 
to order pay-per-view programs on an impulse basis. 
The procedure for ordering such programs can be mod- 
ified through downloadable firmware. Utility meter read- 
ing can also be provided, by adding an asynchronous 
data port to the converter and controlling the retrieval of 
utility data via downloaded firmware. 

A flowchart illustrating a routine which can be used 
by the addressable controller in connection with the re- 
ceipt and downloading of firmware is provided in Figure 
3. The routine begins at box 80, and at box 82 a deter- 
mination is made as to whether a firmware update has 
been received from the firmware development system. 



If so, control passes to box 84 and the new firmware 
data is encrypted. At box 86, the encrypted data is load- 
ed into the secondary data channel transmitter 
(firmware modulator 24) and continuously transmitted 
on the secondary channel together with other firmware 
packages that can be provided to converters on the sys- 
tem. 

At box 88, a determination is made as to whether a 
new firmware package assignment has been made by 
billing system 22. If so, addressable controller 1 4 sends 
an appropriate command on the primary channel (con- 
trol data modulator 26) as indicated at box 90. The com- 
mand is addressed to the particular converter that is to 
receive the firmware, and identifies the channel the 
firmware is to be received from, identifies the firmware 
package to be received, provides the decryption key 
necessary to decrypt the firmware data, identifies the 
number of segments which make up the complete 
firmware package, and sets forth the time-out parameter 
defining the maximum time the converter should stay 
tuned to the secondary channel for receipt of the down- 
loaded firmware. 

The converter receives the firmware in fixed length 
"segments", and specific converter models will have 
specific maximum segment numbers determining the 
actual maximum size of allowable firmware downloads. 
In a preferred embodiment, the maximum segment 
number is a hard-coded parameter. Should an attempt 
be made to download firmware that exceeds the maxi- 
mum size, the download will be rejected by the convert- 
er. In operation, the converter will ignore the download 
command and will not switch to the secondary channel 
if the transmitted maximum segment number parameter 
exceeds the internal converter maximum. 

At box 92 of Figure 3, a determination is made as 
to whether an abort of a download is required. This 
would be the case, for example, if the addressable con- 
troller detects a problem with an attempted download. 
In the event an abort is required, an abort command is 
transmitted over the secondary channel as indicated at 
box 94. The converter will then switch back to the pri- 
mary channel, execute the default operation software to 
return to a baseline operation, and await a subsequent 
command from the addressable controller via the prima- 
ry data channel. At box 96, the routine of Figure 3 ends. 
It will be appreciated by those skilled in the art that the 
routine of Figure 3 is called on a periodic basis (or can 
be a continuous loop) to enable new firmware to be re- 
ceived from the firmware development system and to 
download firmware packages to converters at the com- 
mand of billing system 22. 

Figure 4 illustrates a routine that the addressable 
controller can use to continuously transmit firmware da- 
ta over the secondary channel. The routine commences 
at box 100, and at box 102 data is transmitted over the 
secondary channel. At box 104, a determination is made 
as to whether the last segment of a firmware package 
has been transmitted. If not, transmission of the remain- 
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ing segments continues as indicated at box 102. Once 
the last segment has been transmitted, control passes 
to box 106 and the addressable controller transmits a 
check/execute command to the converter(s) that was to 
receive the firmware package. The check/execute com- 
mand includes the firmware package number that was 
to be received, and a check pattern. The check pattern 
is used to verify the entire download prior to execution. 
When a check/execute command is received, the con- 
verter checks to see if all required segments have been 
received, and that the check pattern downloaded match- 
es the pattern calculated from the actual downloaded 
data. If all checks are valid, the converter permits exe- 
cution of the downloaded code, and returns to the pri- 
mary data channel. After the check/execute command 
is sent at box 106 of Figure 4, control returns to box 102, 
and continuous transmission of the data proceeds over 
the secondary channel. 

Figure 5 is a flowchart illustrating the capture of 
down loaded firmware by a converter. The routine begins 
at box 110, and control passes to box 112 where a de- 
termination is made as to whether a firmware capture 
command has been sent to the converter. If not, the con- 
verter continuously waits for such a command to be re- 
ceived at box 112. 

Once a firmware capture command is received, 
control passes from box 112 to box 120 for the actual 
capture of the firmware. At the same time, an ancillary 
time-out process commences as indicated at boxes 1 1 4, 
116, and 118. A timer counts down the time-out period 
specified in the firmware capture command. If the time- 
out period expires before the specified firmware pack- 
age has been successfully captured, as determined at 
box 1 1 4 t control passes to box 1 1 6 where the download 
is aborted and the converter returns to the primary data 
channel. As indicated at box 118, the default operation 
software is executed so that the converter can operate 
in a baseline mode until the appropriate firmware pack- 
age can be properly downloaded. 

As indicated at box 1 20, before a firmware down- 
load commences, a determination is made as to wheth- 
er the number of segments contained in the firmware 
package to be downloaded is within bounds. In other 
words, as noted above, the maximum segment number 
of the firmware package to be downloaded must not ex- 
ceed the maximum size allowable for the converter. If 
the number of segments exceeds the number allowed 
by the converter, the firmware capture command is ig- 
nored and control returns to box 112. Otherwise, the 
firmware capture proceeds and at box 122, the convert- 
er switches to the secondary channel (i.e., the channel 
on which the firmware is downloaded). At box 124, the 
segments comprising the firmware package are re- 
ceived. Firmware is continuously broadcast on the sec- 
ondary data channel in small (e.g., 32 byte) encrypted 
packets. A converter that has been commanded to ac- 
cept a new package tunes to the appropriate channel 
and loads each packet that has the proper version iden- 



tifier. While loading, the converter keeps track of each 
segment successfully loaded in an internal segment bit 
map. As indicated at box 126, a determination is made 
as to whether a segment has been successfully loaded. 
s This is accomplished by computing a checksum for each 
segment, and comparing the checksum with one down- 
loaded with the firmware segment. If the checksums 
match, the converter decrypts the data contained in the 
segment, stores the data, and sets an appropriate bit in 
a firmware segment bit map as indicated at box 130. In 
storing the data, if prior firmware has been stored in the 
converter, the appropriate segment of the prior firmware 
is overwritten with the newly received data. 

If it is determined at box 1 26 that a segment has not 
been properly loaded (i.e., the computed and download- 
ed checksums do not match), the converter ignores the 
segment and proceeds directly to box 1 32. At box 132, 
a determination is made as to whether the last segment 
in a firmware package has been received. If not, control 
returns to box 124 and the procedure continues until all 
segments are received. 

After the last segment has been received, control 
passes to box 134 which determines if the bit map cre- 
ated at box 1 30 is complete. If the bit map is not com- 
plete, it means that one or more segments were not 
properly loaded and an attempt to receive these seg- 
ments will be made during the next transmission cycle 
of the firmware. In this event, control returns from box 
132 to box 124 where an attempt to receive the entire 
firmware package will again be made. 

As is evident from the flowchart of Figure 5, an in- 
correctly received segment will not overwrite a previous- 
ly correctly received segment. All correctly received 
segments, however, will overwrite previously received 
segments. In this manner, even if there are errors in the 
transmission of certain segments during a download cy- 
cle, all of the segments should be correctly received af- 
ter the completion of several complete transmission cy- 
cles of a firmware package. 

Once all of the segments have been properly re- 
ceived, the bit map will be complete, and box 1 34 will 
pass control to box 1 36. Box 1 36 responds to the check/ 
execute command transmitted by the addressable con- 
troller at box 106 in Figure 4. When the check/execute 
command is received, the converter checks to see if all 
required segments have been received and that the 
check pattern downloaded matches a pattern calculated 
from the actual downloaded data (i.e., the complete 
firmware package). If the patterns do not match, control 
returns to box 124 and additional attempts are made to 
receive the firmware as long as a time-out (box 1 1 4) has 
not occurred. 

If the entire firmware package is determined to be 
valid at box 1 36, control passes to box 1 38 and an ex- 
ecution bit is set permitting the firmware to be executed. 
As an additional level of protection against a software 
pirate, software contained in the converter's ROM (ROM 
56 - Figure 2) can periodically determine if all of the f unc- 



75 



20 



25 



30 



35 



40 



45 



50 



8 



15 



EP 0 399 200 B1 



16 



tionat modules contained in the firmware package are 
being executed, and if not, subsequent execution of the 
firmware can be precluded by turning off a separate, 
special execution bit maintained by the converter 

At box 1 40, the downloading of a firmware package 
is complete, and the converter returns to the primary da- 
ta channel. The routine ends at box 1 42. 

The firmware download process is a destructive 
one. Once a converter receives the command to accept 
a new package, the old downloaded firmware (if any) is 
effectively deleted and cannot be executed. In the pre- 
ferred embodiment, partial downloads are not support- 
ed, and an entire package must be sent. This further 
frustrates a software pirate's efforts, and allows a 
firmware download to be nullified by sending the com- 
mand to accept a package immediately followed by 
sending the command to return to the primary data 
channel. 

The various commands sent by the addressable 
controller to support the firmware download process 
are: 

Accept Firmware Download 
Return to Primary Channel 
Disallow Downloaded Execution 
Load Firmware Segment 
Check/Execute Firmware 
Send Firmware Check Pattern 

The "Accept Firmware Download" command is 
used to initiate the firmware download process. It may 
be sent to one individual converter or globally to a set 
of converters that understand a group address. The ad- 
dressed converter(s) prepares to accept the package 
number, on the appropriate channel, using the given 
firmware decryption key and maximum segment 
number. The firmware download time-out value is also 
given. Upon reception of this command, the converter 
goes into its firmware download mode, in which it must 
not execute any downloaded code. 

The "Return to Primary Channel" command is used 
to force a converter to return to the primary data chan- 
nel. This command may also be sent in a specific format 
to an individual converter, or in group format to a set of 
converters. All converters receiving this command abort 
the current firmware download, clear their firmware seg- 
ment bit maps, and exit the firmware download mode. 

The "Disallow Downloaded Execution" command 
explicitly disallows the execution of any downloaded 
firmware. It may be sent in the specific or group format. 
All converters receiving this command abort execution 
of any downloaded firmware, clear their firmware seg- 
ment bit maps, exit firmware download mode, and exe- 
cute the default operation software contained in ROM 
for baseline operation. Another method of prohibiting 
downloaded firmware from being executed is to send an 
■Accept Firmware Download" command immediately 
followed by a "Return to Primary Channel" command. 



The "Load Firmware Segment" command is used 
to download the individual segments of afirmware pack- 
age. All converters receiving this command, if in 
firmware reception mode, overwrite the appropriate 
5 segment of firmware by the received data. Before actu- 
ally overwriting the code, the converter checks to see if 
the package number matches the commanded package 
number, and calculates the segment check pattern from 
the received data. If the check pattern is correct, the seg- 
ment data is decrypted, the appropriate prior segment 
is overwritten with the new segment, and the appropri- 
ate bit in the firmware segment bit map is set. 

The "Check/Execute Firmware" command is used 
to terminate the firmware download process. All con- 
verters receiving this command respond only if the pack- 
age number matches the one sent originally in the "Ac- 
cept Firmware Download" command, and if in firmware 
reception mode. If so, the converter checks to see if all 
of the necessary segments of firmware have been cor- 
rectly received. If they have been, the package check 
pattern is calculated and tested. If the check pattern is 
bad, the converter ignores the command. If the check 
pattern is good, the converter permits execution of the 
newly downloaded package, switches back to the pri- 
mary data stream, exits the firmware download mode, 
and clears its firmware download segment bit map. 

The "Send Firmware Check Pattern" command is 
used to verify the firmware download process. A con- 
verter receiving this command responds only if it is not 
in firmware reception mode. In this event, the converter 
reports the check pattern of the appropriate segment or 
of the entire package. This verification scheme is only 
available on a two-way cable system. 

Figure 6 illustrates a periodic self-check routine 
used by the converter to test the validity of downloaded 
firmware to ensure that it has not changed since the last 
download. This self-check is performed by the converter 
itself, and no addressable controller command is re- 
quired to initiate it. The routine begins at box 1 50. At box 
152, a clock runs to keep track of time. At box 154, a 
determination is made as to whether a predetermined 
time interval has passed. If not, the routine loops back 
to box 152 and the process continues until the time in- 
terval has run. Then, box 1 54 passes control to box 1 56 
to commence the periodic self -check. 

At box 156, the first segment of the firmware pack- 
age is tested by computing its checksum. At box 158, a 
determination is made as to whether the checksum is 
the proper checksum for that segment. If not, control 
passes to box 1 60 and the default operation software is 
executed to return the converter to baseline operation. 
If the checksum for the segment is proper, control pass- 
es to box 162, which determines if the segment just test- 
ed is the last segment in the firmware package. If not, 
the routine loops back to box 156 so that all of the seg- 
ments in the firmware package can be tested. 

Once the last segment has been tested, control is 
passed from box 1 62 to box 1 64 where the clock is reset. 
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Control then loops back to box 1 52 and the process con- 
tinues, so that the self-check will be periodically per- 
formed at the time interval dictated by the time-out de- 
termination function at box 154. 

It will now be appreciated that the present invention 
provides a method and apparatus for remotely modify- 
ing the functionality of a terminal, such as a cable tele- 
vision converter. Terminal functions are dictated by 
downloaded firmware. The firmware is transmitted in 
small segments to reduce the likelihood and severity of 
transmission errors, and to reduce the temporary buff- 
ering requirements within the terminal. Each section of 
a firmware package is transmitted with an identifier in- 
dicating which segment it is, and which firmware pack- 
age it is part of. A multiplicity of firmware packages may 
be carried on a single system, with different terminals in 
the system accepting and executing different packages 
as specified by the system headend. 

The firmware is stored at the terminal in nonvolatile 
memory, such as RAM with a battery backup, various 
safeguards are provided to ensure that the firmware is 
accurately downloaded, and to frustrate the efforts of a 
software pirate attempting to infiltrate the system. 



Claims 

1. A remotely controllable cable television converter 
(40) which is able to operate in a baseline mode al- 
lowing the reception of a television program and 
which, upon receipt of functional operating software 
(firmware) downloaded from a remote cable televi- 
sion headend (10), can be provided with higher lev- 
els of converter functions resulting in an increased 
converter functionality in addition to said baseline 
mode, said converter comprising: 

means (52, 50) for receiving said functional op- 
erating software (firmware) downloaded from 
said remote cable television headend (10); 

means (60) coupled to said receiving means for 
storing said downloaded functional operating 
software (firmware); 

means (50) for verifying said downloaded func- 
tional operating software (firmware); 

processor means (50) coupled to said storing 
means (60) for accessing and executing said 
downloaded functional operating software 
(firmware); 

nonvolatile memory means (56) coupled to said 
processor means (50) for storing default oper- 
ation software, said default operation software 
providing said baseline mode operation to said 
converter (40); and 



means (50) responsive to said verifying means 
(50) for causing said processor means to exe- 
cute said default operation software instead of 
said downloaded functional operating software 
s (firmware) in the event the downloaded soft- 

ware is invalid or contains errors. 

2. The converter of claim 1 , wherein said receiving 
means comprise data receiving means (52) for ob- 
io tain in g specific instruction data downloaded from 
said cable television headend (10), said data re- 
ceiving means enabling said receiving means only 
in response to said specific instruction data. 

is 3. The converter of claim 2 wherein said data receiving 
means comprise: 

a frequency tunable data receiver (52); and 

20 means (54) for selectively tuning said receiver 

(52) to receive said instruction data on a first 
channel and said functional operating software 
(firmware) on a second channel. 

2S 4. The converter of claim 3 further comprising: 

timer means (64) for returning said receiver (52) to 
said first channel if it has been tuned to said second 
channel for a predetermined time period. 

30 5. The converter of claim 4 wherein said predeter- 
mined time period is specified in instructions re- 
ceived on said first channel. 

6. The converter of claim 5 wherein the length of said 
35 predetermined time period is dependent on an 

amount of said functional operating software 
(firmware) to be received. 

7. The converter as defined in one of claims 1 to 6 
40 wherein said functional operating software 

(firmware) implements a functional layout on a key- 
board (68) associated with said converter (40). 

8. The converter as defined in one of claims 1 to 7 
45 wherein said functional operating software 

(firmware) implements a feedback function to assist 
a user in operating said converter (40). 

9. The converter as defined in one of claims 1 to 8 
so wherein said functional operating software 

(firmware) implements a control function for a video 
recorder coupled to said converter (40). 

10. The converter as defined in one of claims 1 to 9 
55 wherein said functional operating software 

(firmware) implements a communication protocol 
for said converter (40). 
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11. The converter as defined in one of claims 1 to 10 
wherein said functional operating software 
(firmware) implements a descrambling technique 
for said converter (40). 

12. The converter as defined in one of claims 1 to 11 
wherein said functional operating software 
(firmware) implements an on-screen display to be 
provided by said converter (40) to a television set 
(44) coupled thereto. 

13. The converter as defined in one of claims 1 to 12 
wherein said functional operating software 
(firmware) implements a user interface to services 
provided over a cable television network. 

14. The converter as defined in one of claims 1 to 13 
wherein said functional operating software 
(firmware) implements an electronic mail capability 
to be provided over a cable television network. 

15. The converter as defined in one of claims 1 to 14 
wherein said functional operating software 
(firmware) implements a viewership monitoring 
function. 

16. The converter as defined in one of claims 2 to 15 
wherein said functional operating software 
(firmware) is transmitted in an encrypted form, and 
said instruction data contain a key for decrypting 
said functional operating software (firmware). 

17. The converter as defined in one of claims 2 to 16 
wherein said functional operating software 
(firmware) is received in a plurality of segments, and 
said instruction data identify the number of seg- 
ments to be received for a complete functional op- 
erating software download. 

18. The converter of claim 17 further comprising: 

means (50) for determining if all of said seg- 
ments have been validly received; and 

means for receiving replacement segments if 
one or more segments of said functional oper- 
ating software (firmware) has not been validly 
received. 

19. The converter as defined in one of claims 17 or 18 
further comprising: 

means (50) for preventing the receipt of said func- 
tional operating software (firmware) if the number 
of segments identified by said instruction data is 
greater than a predetermined limit. 

20. The converter as defined in one of claims 1 to 1 9 
wherein said verifying means (50) are verifying said 



downloaded functional operating software 
(firmware) after it has been stored. 



5 Patentanspruche 

1. Fernbedienbarer Kabelfemsehkonverter (40), wel- 
cher in einem Grundlinien-Modus arbeiten kann, 
der den Empfang eines Fernsehprogramms er- 

10 laubt, und welcher, nach Erhalt funktioneller Be- 
triebs-Software (Firmenware), die von einem ent- 
fernten Kabelfernseh-Kopfende (10) zugeladen 
wird, mit hoheren Ebenen von Konverter-Funktio- 
nen versehen werden kann, welche in einer vergro- 

'5 Gerten Konverter-Funktionalitat zusatzlich zu dem 
Grundlinien-Modus resultiert, wobei der Konverter 
umfaGt: 

Mittel (52,50) zum Empfangen der funktionel- 
20 |en Betriebs-Software (Firmenware), welche 

von dem entfemten Kabelfernseh-Kopfende 
(10) zugeladen wird; 

Mittel (60), die an die empfangenden Mittel zum 
25 Speichern der zugeladenen funktionellen Be- 

triebs-Software (Firmenware) angekoppelt 
sind; 

Mittel (50) zum Verifizieren der zugeladenen 
30 funktionellen Betriebs-Software (Firmenware); 

Prozessor-Mittel (50), welche an die speichern- 
den Mittel (60) angekoppelt sind, zum Zugrei- 
fen auf und Ausfuhren der zugeladenen funk- 
35 tionellen Betriebs-Software (Firmenware); 

Nichtfluchtig-Speicher-Mittel (56), die an die 
Prozessor-Mittel (50) angekoppelt sind, zum 
Speichern von Vorgabe-Betriebssoftware, wo- 
40 bei die Vorgabe-Betriebssoftware dem Konver- 

ter (40) den Grundlinienmodus-Betrieb bereit- 
stellt; und 

Mittel (50), die auf die verifizierenden Mittel (50) 
45 ansprechen , urn die Prozessor-Mittel zu veran- 

lassen, die Vorgabe- Betriebs-Software anstatt 
der zugeladenen funktionellen Betriebs-Soft- 
ware (Firmenware) auszufuhren im Falle, daB 
die zugeladene Software ungultig ist oder Feh- 
so ler enthalt. 

2. Konverter nach Anspruch 1 , wobei die empfangen- 
den Mittel datenempfangende Mittel (52) zum Er- 
halten von spezifischen Instruktionsdaten, welche 

55 von dem Kabelfernseh-Kopfende (10) zugeladen 
werden, umfassen, wobei die datenempfangenden 
Mittel die empfangenden Mittel nur als Antwort auf 
die spezifischen Instruktionsdaten ermachtigen. 
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3. Konverter nach Anspruch 2, wobei die datenemp- 
fangenden Mittel umfassen: 

einen frequenz-abstimmbaren Datenempfan- 
ger (52); und 

Mittel (54) zum Abstimmen des Empf angers 
(52) auf selektive Weise, um die Instruktions- 
daten auf einem erst en Kanal zu empfangen 
und die funktionelle Betriebs-Soflware (Fir- 
menware) auf einem zweiten Kanal. 

4. Konverter nach Anspruch 3, welcher weiter umfaGt: 
Zeitgeber- Mittel (64) zum Bewirken der Ruckkehr 
des Empfangers (52) auf den ersten Kanal, wenn 
er auf den zweiten Kanal fur eine vorbestimmte 
Zeitdauer abgestimmt worden ist. 

5. Konverter nach Anspruch 4, wobei die vorbestimm- 
te Zeitdauer in Instruktionen spezifiziert ist, die auf 
dem ersten Kanal empfangen werden. 

6. Konverter nach Anspruch 5, wobei die Lange der 
vorbestimmten Zeitdauer abhangig ist von einem 
Umfang der funktionellen Betriebs-Software (Fir- 
menware), die empfangen werden soli. 

7. Konverter nach einem der Anspruche 1 bis 6, wobei 
die funktionelle Betriebs-Software (Firmenware) 
ein funktionelles Lay-out auf einer Tastatur (68), die 
mit dem Konverter (40) assoziiert ist, implementiert. 

8. Konverter nach einem der Anspruche 1 bis 7, wobei 
die funktionelle Betriebs-Software (Firmenware) ei- 
ne Ruckkopplungsfunktion implementiert, um ei- 
nem Benutzer bei der Bedienung des Konverters 
(40) zu helfen. 

9. Konverter nach einem der Anspruche 1 bis 8, wobei 
die funktionelle Betriebs-Software (Firmenware) ei- 
ne Kontrollfunktion fur einen Videorecorder imple- 
mentiert, der an den Konverter (40) gekoppelt ist. 

10. Konverter nach einem der Anspruche 1 bis 9, wobei 
die funktionelle Betriebs-Software (Firmenware) 
ein Kommunikationsprotokoll fur den Konverter 
(40) implementiert. 

11. Konverter nach einem der Anspruche 1 bis 10, wo- 
bei die funktionelle Betriebs-Software eine Ent- 
schlusselungsmethode fur den Konverter (40) im- 
plementiert. 

12. Konverter nach einem der Anspruche 1 bis 11, wo- 
bei die funktionelle Betriebs-Software (Firmenwa- 
re) eine Bildschirmanzeige implementiert, welche 
durch den Konverter (40) an ein daran gekoppeltes 
Fernsehgerat (44) bereitgestellt wird. 



13. Konverter nach einem der Anspruche 1 bis 12, wo- 
bei die funktionelle Betriebs-Software (Firmenwa- 
re) eine Benutzer-Schnittstelle zu Diensten, die 
uber ein Kabelfemseh-Netzwerk bereitgestellt wer- 

s den, implementiert. 

14. Konverter nach einem der Anspruche 1 bis 13, wo- 
bei die funktionelle Betriebs-Software (Firmenwa- 
re) eine Fahigkeit fur elektronische Briefe (Mail) im- 

io plementiert, welche uber ein Kabelfernseh-Netz- 
werk bereitgestellt wird. 

15. Konverter nach einem der Anspruche 1 bis 14, wo- 
bei die funktionelle Betriebs-Software (Firmenwa- 

15 re) eine Zuschauerschaft-Uberwachungsfunktion 
implementiert. 

16. Konverter nach einem der Anspruche 2 bis 1 5, wo- 
bei die funktionelle Betriebs-Software (Firmenwa- 

20 re) in einer verschlusseften Form ubertragen wird 
und die Instruktionsdaten einen Schlussel zum Ent- 
schlusseln der funktionellen Betriebs-Software (Fir- 
menware) enthalten. 

25 17. Konverter nach einem der Anspruche 2 bis 16, wo- 
bei die funktionelle Betriebs-Software (Firmenwa- 
re) in einer Mehrzahl von Segmenten empfangen 
wird, und wobei die Instruktionsdaten die Anzahl 
der Segmente, die fur eine vollstandige funktionelle 

30 Betriebs-Software-Zuleitung empfangen werden 
sollen, identifizieren. 

18. Konverter nach Anspruch 17, der weiter umfaGt: 

35 Mittel (50) zum Bestimmen, ob jedes der Seg- 

mente richtig empfangen worden ist; und 

Mittel zum Empfangen von Ersetzungsseg- 
menten, wenn ein oder mehrere Segmente der 
^0 funktionellen Betriebs-Software (Firmenware) 

nicht auf richtige Weise empfangen worden 
sind. 

19. Konverter nach Anspruch 17 oder 18, welcher wei- 
45 ter umfaRt: 

Mittel (50) zum Verhindern des Empfangs der funk- 
tionellen Betriebs-Software (Firmenware), wenn 
die Anzahl der Segmente, welche durch die Instruk- 
tionsdaten identifiziert werden, groGer als ein vor- 
50 bestimmter Grenzwert ist. 

20. Konverter nach einem der Anspruche 1 bis 1 9, wo- 
bei die verifizierenden Mittel (50) die zugeladene 
funktionelle Betriebs-Software (Firmenware) verifi- 

55 zieren, nachdem sie gespeichert wurde. 
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Revendications 

1 . Convertisseur (40) de television par cable, qui peut 
etre commands a distance, qui peut fonctionner 
dans Un mode de ligne de reference, permettant la 
reception d'un programme de television, et qui, a la 
reception d'un logiciel (microprogramme) d'exploi- 
tation fonctionnel transfer^ depuis une extremite 
amont (10) SloignSe de television par cable, peut 
etre muni de niveaux superieurs de tonctions de 
convertisseur donnant lieu en une fonctionnalit6 ac- 
crue du convertisseur, en supplement au mode a 
ligne de reference, le convertisseur comprenant : 

des moyens (52, 50) pour recevoir le logiciel 
(microprogramme) d'exploitation fonctionnel 
transfers depuis l'extr6mitS amont (10) eloi- 
gned de television par cable, 
des moyens (60) raccordes aux moyens de re- 
ception precites en vue de memoriser le logiciel 
(microprogramme) d'exploitation fonctionnel 
transf6re, 

des moyens (50) pour verifier le logiciel (micro- 
programme) d'exploitation fonctionnel transfe- 
rs, 

des moyens de traitement (50) raccordes aux 
moyens de memorisation (60) afin d'acc6der a 
et d'exScuter le logiciel (microprogramme) 
d'exploitation fonctionnel transfers, 
des moyens de memorisation r6manente (56) 
raccordes aux moyens de traitement (50) en 
vue de mSmoriser un logiciel d'exploitation par 
d6faut, le logiciel d'exploitation par d6faut four- 
nissant au convertisseur (40) ledit fonctionne- 
ment en mode a ligne de reference, et 
des moyens (50) qui r6pondent aux moyens de 
verification (50) pour amener les moyens de 
traitement a ex6cuter le logiciel de fonctionne- 
ment par defaut au lieu du logiciel (micropro- 
gramme) d'exploitation fonctionnel transfer, 
au cas ou le logiciel transfers n'est pas valide 
ou contient des erreurs. 

2. Convertisseur suivant la revendication 1 , caracteri- 
s6 en ce que les moyens de reception comprennent 
des moyens (52) de reception de donn6es en vue 
d'obtenir des donnees d'instruction specifiques 
transferees depuis PextremitS amont (10) de la te- 
levision par cable, les moyens de reception de don- 
nees ne valtdant les moyens de reception qu'en r6- 
ponse auxdites donnees d'instruction specifiques. 

3. Convertisseur suivant la revendication 2, caracte ri- 
se en ce que les moyens de reception de donnees 
comprennent : 

un r6cepteur de donnees (52) accordable en 
frequence, et 



des moyens (54) afin d'accorder seiectivement 
le r6cepteur (52) pour recevoir les donnees 
d'instruction sur un premier canal et le logiciel 
(microprogramme) d'exploitation fonctionnel 
5 sur un second canal. 

4. Convertisseur suivant la revendication 3, caract6ri- 
se en ce qu'il comprend en outre : 

des moyens de temporisation (64) pour rame- 
io ner le recepteur (52) sur le premier canal s'il a ete 
accorde sur le second canal pour une periode de 
temps pr6d6terminee. 

5. Convertisseur suivant la revendication 4, caracteri- 
is sS en ce que la periode de temps predSterminSe 

est prScisee dans des instructions recues sur le pre- 
mier canal. 

6. Convertisseur suivant la revendication 5, caracteri- 
20 s6 en ce que la longueur de la periode de temps 

predetermined depend d'une valeur du logiciel (mi- 
croprogramme) d'exploitation fonctionnel a rece- 
voir. 

25 7. Convertisseur suivant Tune des revendications 1 a 

6, caract6ris6 en ce que le logiciel (microprogram- 
me) d'exploitation fonctionnel realise une disposi- 
tion fonctionnelle sur un clavier (68) associe au con- 
vertisseur (40). 

30 

8. Convertisseur suivant Tune des revendications 1 a 

7, caracterisS en ce que le logiciel (microprogram- 
me) d'exploitation fonctionnel execute une fonction 
de retroaction afin d'aider un utilisateur a faire fonc- 

3s tionner le convertisseur (40). 

9. Convertisseur suivant Tune des revendications 1 a 

8, caract6ris6 en ce que le logiciel (microprogram- 
me) d'exploitation fonctionnel realise une fonction 

40 de commande pour un enregistreur video raccorde 
au convertisseur (40). 

10. Convertisseur suivant Tune des revendications 1 a 

9, caracterisS en ce que le logiciel (microprogram- 
's me) d'exploitation fonctionnel execute un protocole 

de communication pour le convertisseur (40). 

11. Convertisseur suivant Tune des revendications 1 a 

10, caract6ris6 en ce que le logiciel (microprogram- 
s' me) d'exploitation fonctionnel execute une techni- 
que de desembrouillage pour le convertisseur (40). 

12. Convertisseur suivant Tune des revendications 1 a 

11 , caract6ris6 en ce que le logiciel (microprogram- 
s' me) d'exploitation fonctionnel execute un affichage 

sur 6cran a fournir par le convertisseur (40) a un 
ensemble de television (44) qui y est raccorde. 
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13. Convertisseur suivant Tune des revendications 1 a 
1 2, caracterise en ce que le logiciel (microprogram- 
me) Sexploitation fonctionnet realise un interface 
d'utilisateur pour des services fournis sur un reseau 



14. Convertisseur suivant Tune des revendications 1 a 

13, caracterise en ceque le logiciel (microprogram- 
me) d'exploitation fonctionnel execute une possibi- 
lity d'expedition de courrier electronique a prevoir J0 
sur un reseau de television par cable. 

15. Convertisseur suivant Pune des revendications 1 a 

14, caracterise en ce que le logiciel (microprogram- 
me) d'exploitation fonctionnel execute une fonction is 
de surveillance d'un ensemble de spectateurs. 

16. Convertisseur suivant Pune des revendications 2 a 

15, caracterise en ce que le logiciel (microprogram- 
me) d'exploitation fonctionnel est transmis sous une 20 
forme cod6e et en ce que lesdites donnees d'ins- 
truction component une clef pour decoder le logiciel 
(micro prog ram me) d'exploitation fonctionnel. 

17. Convertisseur suivant Pune des revendications 2 a 25 

16, caracteris6 en ce que le logiciel (microprogram- 
me) d'exploitation fonctionnel est regu dans une 
pluralite de segments et en ce que les donnees 
destruction susdites identifient le nombre de seg- 
ments a recevoir pour un transfer! complet de logi- 30 
ciel d'exploitation fonctionnel. 

18. Convertisseur suivant la revendication 17, caracte- 
rise en ce qu'il comprend en outre : 



des moyens (50) pour d6terminer si tous les 
segments ont ete recus de facon valide, et 
des moyens pour recevoir des segments de 
remplacement si un ou plusieurs segments du 
logiciel (microprogramme) d'exploitation fonc- 40 
tionnel n'ont pas et6 recus de facpn valide. 

19. Convertisseur suivant I'une des revendications 17 
ou 1 8, caracterise en ce qu'il comprend en outre des 
moyens (50) pour empecher la reception du logiciel 45 
(microprogramme) d'exploitation fonctionnel si le 
nombre de segments identifie par lesdites donnees 
d'instruction est superieur a une limite predetermi- 
nee. 



20. Convertisseur suivant I'une des revendications 1 a 
1 9, caracteris6 en ce que les moyens de verification 
(50) verifient le logiciel (microprogramme) d'exploi- 
tation fonctionnel transfere, apres qu'il a ete m6mo- 



de television par cable. 
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